Re: [Xen-users] iptables and state matches (established, related)

[Tomas Lund <tlund@xxxxxx>]

On Tue, 10 Apr 2007, Andrey Oreshnikov wrote:

> I use xen-3.0.4_1 ( linux-2.6.16.33 ) and have some promblem with it and 
> iptables. I installed both from source and from rpms for Suse. The 
> problem is in both.
> The iptables state match don't work in INPUT and OUTPUT chains but work 
> in FORWARD chain. For example rule
> iptables  -A INPUT -p ALL -m state --state ESTABLISHED,RELATED -j ACCEPT
>
> don't match any packets in established connection.
>
> Necessarily modules are loaded
>
> # lsmod | grep conntrack
> ip_conntrack_ftp       12144  1 ip_nat_ftp
> ip_conntrack           58584  3 ip_nat_ftp,ip_nat,ip_conntrack_ftp
> nfnetlink              10520  2 ip_nat,ip_conntrack
>
> # cat /proc/net/ip_conntrack
> tcp 6 186909 ESTABLISHED src=192.168.0.170 dst=192.168.0.124 sport=29664 
> dport=22 packets=1 bytes=52 [UNREPLIED] src=192.168.0.124 
> dst=192.168.0.170 sport=22 dport=29664 packets=0 bytes=0 mark=0 use=1
> This rule work fine:
>
> IPTABLES   -A FORWARD -p ALL -m state --state ESTABLISHED,RELATED -j ACCEPT
>
> In xen-3.0.2 from sles distribution this problem is absent. any 
> suggestion?
I can confirm the problem Andrey is describing.

When I try to connect to an external host, the "SYN_SENT" state does not 
show up in /proc/net/ip_conntrack and the SYN+ACK packet from the external 
host is dropped. (The "SYN_SENT" state is what allows the iptables 
"ESTABLISHED" match to occur.)
Before starting XEN (and the briding) it works with the same iptables 
rules. (See rules below)
I'm not sure this really has anything to do with XEN, but rather how the 
bridging works, but I "hope" that other people on this list has the same 
problem, and possibly someone has even found a solution?
Sample commands to reproduce the problem:

iptables -F
iptables -A INPUT -m state --state ESTABLISHED -j ACCEPT
iptables -A INPUT -j DROP
telnet [host] [port]

//tlund


_______________________________________________
Xen-users mailing list
Xen-users@xxxxxxxxxxxxxxxxxxx
http://lists.xensource.com/xen-users